1

Assume a scenario where we have a modular system including:

  1. an Authentication Module (AM) which gets username and password of an internet user and issues a token for the user. User<-->AM communication is secured by TLS and AM has a certificate from a known Certificate Authority.

  2. Some services that accept {Token, Request} from users and validate Token with AM and serve the Request. Each service is implemented on an independent server.

Tokens are bearer tokens. If we enable TLS for User-Service communication, do we need to get a certificate for each (service) server to make sure that Man-in-the-middle attack is not possible and tokens will remain confidential?

Improve this question
2
  • Note: this is not a dupe of a closed question. The other question was re-written to this and then deleted. This is an attempt at an improved version.
    – schroeder ♦
    Sep 28, 2019 at 19:19
  • For Internet usage, you should consider using and OpenID Connect library which is widely used and has proven reliability for such purposes.
    – jwilleke
    Sep 30, 2019 at 11:35

2 Answers 2

Reset to default
1

Yes

If the server doesn't present a certificate (or it is not validate), the client will happily give {Token, Request} to the presumed server. A MITM could act as the server, receive the tokens and requests and pass them to the real server.

They do not need to be signed by a public CA, though. You could be using your own PKI (a private CA to sign those certificates) if that makes your life easier.

Improve this answer
0

When user is communicating with server, the user needs to confirm they're really talking to service and not to a man in the middle attacker. This is usually done with certificates. Using regular webpki certs (like Let's Encrypt) is most convenient, but if you can't, maybe you can use pinned self-signed certs or maybe you can use your own CA that issues certs to services. This all depends on how you're going to manage the configuration on the clients - they need to know which key to trust, and they need to be updated when that key needs to rotate.

Improve this answer
2
  • We can configure clients. They are internet users who they call REST APIs provided by our servers. I think TLS does not support webPKI. But TLS supports Certificate. Am I correct?
    – Reza
    Sep 28, 2019 at 19:49
  • "webpki" is just "certificates browsers trust by default". For clients you do not control, regular certificates like Let's Encrypt are best. For a mobile app that communicates with its cloud server (server and client under control of single company), a pinned self signed cert has benefits (but also requires more work to manage especially w.r.t to cert rotation).
    – Z.T.
    Sep 28, 2019 at 19:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .